rule  100000 TestTxt.a {
    meta:
        description = '测试文本'

    strings:
        '这是一个测试'
        /这是.*测试/
        [e8bf99e698afe4b880e4b8aae6b58be8af95]
        {e8bf99e698afe[a-f0-9]+b8aae6b58be8af95}

    condition:
        all of them
}

rule  100005 TestZip.a {

    meta:
        type = 'zip'
        description = '测试 1.zip'

    strings:
        zip.subfile('1.txt', '这是一个测试')
        zip.subfile('1.txt', /这是.*测试/)
        zip.subfile('1.txt', [e8bf99e698afe4b880e4b8aae6b58be8af95])
        zip.subfile('1.txt', {e8bf99e698afe[a-f0-9]+b8aae6b58be8af95})

    condition:
        all of them
}


rule  100003 TestAPK.a {

    meta:
        type = 'apk'
        description = '测试 1.apk'

    strings:
        apk.manifest("com.example.hellojni")
        apk.manifest(/com\.\w+\.hellojni/)

        apk.dex.string("Lcom/example/hellojni/") 
        apk.dex.string(/com/\w+/hellojni/) 
        apk.dex.string([4c636f6d2f6578616d706c652f68656c6c6f6a6e692f]) 
        apk.dex.string({636f6d2f[0-9a-f]{14}2f68656c6c6f6a6e69})

        apk.subfile('1.zip', '')
        apk.subfile('libhellojni.so', '')
        apk.subfile("1.txt", "测试")
        apk.subfile('1.txt', '这是一个测试')
        apk.subfile('1.txt', /这是.*测试/)
        apk.subfile('1.txt', [e8bf99e698afe4b880e4b8aae6b58be8af95])
        apk.subfile('1.txt', {e8bf99e698afe[a-f0-9]+b8aae6b58be8af95})

        a = apk.manifest.main_activity
        apk.dex.class(a)

    condition:
        all of them
}


rule 100004 Packer.A {
    meta:
        type = 'apk'
        description = '通用加固包'

    strings:
        a = apk.manifest.application
        b = apk.dex.class(a)
        c = apk.manifest.main_activity
        d = apk.dex.class(c)
    condition:
        b && !d
}